An efficient quantum secret sharing scheme with Einstein-Podolsky-Rosen Pairs 
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An efficient quantum secret sharing scheme is proposed. In this scheme, the particles in an 
entangled pair group form two particle sequences. One sequence is sent to Bob and the other is sent 
to Charlie after rearranging the particle orders. Bob and Charlie make coding unitary operations 
and send the particles back. Alice makes Bell-basis measurement to read their coding operations. 

PACS numbers: 03.67.Hk, 03.65.Ud 

(N ■ 

Secret sharing is a classical cryptographic scheme in which one use, Alice, can split her message into two parts 
between two agents, Bob and Charlie respectively 0,0.03]. It is assumed that Bob and Charlie can read out the 
message only when they act in concert. The combination of quantum mechanics with information theory has provided 
us with new tools for many tasks. One mature application of quantum information is quantum key distribution (QKD) 
with which two remote parties of communication can create a private key unconditionally securely 4, 5j. The quantum 
■ version of secret sharing is quantum secret sharing(QSS). In quantum secret sharing, both classical and quantum 
information can be shared while the latter is called quantum state sharing which has no classical counterpart. An 
original QSS scheme that shares classical information was proposed by Hillery, Buzek and Berthiaume B in 1999, 
' which is called HBB99 hereafter. There have been many theoretical development in this subject 0, B SHU EH 13 
IT3I ITiL IHi IrH IrsL ITii l20l I2TL l22l| and it has been also studied experimentally^. One advantage of quantum 
mechanics is that distribution of the message can be done securely on-site. 

In QSS, Alice has to protect the quantum information from eavesdropping by the dishonest one among Bob and 
Charlie and the other malicious eavesdroppers. We call the eavesdropper as Bob*. In the HBB99 scheme, the secret 
sharing is accomplished by using three-photon entangled Greenberger-Horne-Zeilinger (GHZ) states j^. Each party 
holds a particle from a GHZ state, and each participant chooses randomly from the x-measuring-basis(a;-MB) and the 
y-MB to measure the particle respectively, a situation similar to the Bcnnctt-Brassard-Mermin 1992 (BBM92) QKD 
scheme|23. Karlsson, Koashi and Imoto put forward a QSS scheme Q with two-photon polarization-entangled state. 
In these protocols, the participants choose randomly one from two measuring-basis to measure the polarization of the 
states, and their intrinsic efficiency, the number of valid particles to the number of total particles, is 50% because 
half of the instances are discarded. In addition, in each accepted round of communication, one bit of information is 
shared between the participants. During this process, four bits of classical communications are required: two bits of 
information about the measuring-basis of the two participants and another two bits of information about the measured 
results. 

In this Letter, we present a QSS scheme with Einstein-Podolsky-Rosen (EPR) pairs. Our protocols employs the 
dense coding 26] and an order-rearrangement idea. The basic idea of order-rearrangement is that Alice mixes up 
the correct correlation of EPR pairs so that Bob* does not know which two particles are the particles in an EPR 
pair and he can not perform Bell-basis measurement to steal the secret information. Later Alice restores the correct 
correspondence of particles and obtains the result with Bell-basis measurement. In dense coding, a single qubit can 
communicate two bits of information by taking advantage of quantum entanglement. The proposed QSS scheme has 
three advantages. First, the intrinsic efficiency is nearly 100%, all the EPR pairs except those used for eavesdropping 
check are retained for secret sharing. Secondly, inherited from dense coding 26] , each EPR pair carries two bits of 
information. Thirdly, the classical information exchanged is reduced largely. 
An EPR pair is in one of the four Bell states shown as follows: 

|<F) = ^m B \l) c -\l) B \Q) c ) = ±={\-x) B \+x) c -\ + x) B \-x)c) (1) 
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|V> + ) - ^(|0) B |l) c + \1) B \0) c ) = -^(| + x)b\ + x)c - | - x) B \ - x) c ) (2) 

\4>-) = ^(|0) B |0) c -|l) B |l) c ) = -^(|- : r) B |+x)c + |+ar)B|- : r)c) (3) 

= ^(|Q)s |0) c + |1) B |1> C ) = ^(| + x) B \ + x) c + | - x) B \ - x) c ) (4) 

where |0) and |1) are the eigenvectors of the Pauli operators a z : 

^|0) = |Q), <t,|1)=-|1), (5) 

and | + x) and | — x) are the eigenvectors of the a x Pauli operator: 

(Jx\ + x) = | + x), cr z \-x)=-\-x). (6) 

In the Bell states, the results of the a z or a x measurement on the two particles are correlated that can be seen directly 
form Eqs.JTJ-gl). 

An EPR pair can carry two bits of classical information, using the dense coding operations, 

U =/=|0>(0| + |l)(l|, (7) 
Ux = a z = |0> <0| - |1> (1| , (8) 

u 2 =^ = 11x01 + 10x11, (9) 

U 3 =i ffy = |0)(l|-|l)<0|. (10) 

The following naive QSS protocol is not secure: Alice sends the two particles of an EPR pair to Bob and Charlie 
respectively. Bob and Charlie then make an coding operation using one of the operations in Eqs. l(7|l.(|5|).lj§|l. (|10|) and 
return the particles to Alice. By making a Bell-basis measurement, Alice knows the combined operation of Bob and 
Charlie which is the shared key. As Bell-basis states are orthogonal states, Bob* can use the intercept-resend attack 
to get the secret information without being detected, as pointed out in Ref.|8|]. 

To guard the secret information from eavesdropping, one method is not allowing Bob* to acquire simultaneously 
both particles of an EPR pair. Because the information is encoded in the EPR pair, it can only be read by a Bell- 
basis measurement if the EPR pair is randomly in one of the four Bell states [27|. In the same spirit, if the correct 
correspondence of particles in EPR pairs are mixed up, an outsider can not know which two particles arc in the same 
EPR pairs. What he can do is just to make a guess of this correspondence. Inevitably, he will cause significant 
errors in the data if he tries to eavesdrop. This property has been exploited for QKD in Ref. [27], H^, |2(| . In the 
present work, this property is exploited for quantum secret sharing. Suppose Alice sends the EPR pairs in group of 
four each time, seen in Fig.l. In each group, Alice takes one particle from each pair to form a particle sequence and 
sends the sequence in its original order through the AB channel, a channel that connects Alice and Bob, to Bob. The 
remaining four particles also form a particle sequence, and Alice makes an order rearrangement of the particles and 
then sends them through the AC channel, a channel connects Alice and Charlie, to Charlie. Without knowing the 
correct correspondence of particles in the AB channel and AC channel, an eavesdropper can not make orthogonal 
measurement to obtain the deterministic information about the state. Alice has many different ways to rearrange the 
particle order in a sequence. For a group of four objects, there are altogether 4! = 24 permutation operations. Any 
one of them can be used for the order rearrangement. Depicted in Figgis an example of four such rearrangement 
operations. Operation Eq = I is the identity operation and no change is made to the particle order, thus the particle 
in the AB channel and the corresponding particle in the AC channel are the two particles in the same EPR pair. 
If the rearrangement operation is Ex, Alice exchanges the order of particles 1 and 2, and particles 3 and 4 in the 
AC channel, and hence particles 1, 2, 3, 4 in the AB channel and particles 2,1, 4,3 in the AC channel form EPR 
pairs respectively. Without knowing the correct particle correspondence, Bob*'s Bell-basis measurement will obtain 
no useful information and collapses the quantum correlation in the genuine EPR pair. This leaves his mark in the 
result, and the participants can find Bob* by checking a subset of results of their measurements. 

Now we first give the details of the QSS scheme. For simplicity we fix the number of EPR pairs in each group to 
four, and the number of rearrangement operations is also restricted to four. The security analysis will be given below. 
For simplicity we first assume ideal conditions, perfect detection efficiency and noiseless channel. 

(1) Alice prepares a sequence of EPR pairs randomly in one of the four Bell-basis states. Alice makes a record of 
the EPR pair states. These EPR pairs are divided into groups, each group has four EPR pairs. 

(2) Alice takes each particle from an EPR pair in a group and sends these four particles in its original order through 
the AB channel to Bob. Alice makes an order rearrangement operation to the remaining four particles using randomly 
one of four operations shown in Fig|3 and then sends them through the AC channel to Charlie. 



3 



(3) After receiving the particles, Bob and Charlie, randomly and independently chooses one of the following two 
modes: with a small probability p the checking mode, or with a large probability 1 — p the coding mode. If Bob or 
Charlie chooses the checking mode, then he goes to step (3a), otherwise he chooses the coding mode and continues 
to step (3b). 

(3a) When Bob or Charlie chooses the checking mode, he measures his particle randomly in the the a z basis or 
the a x basis , and publishes the position of the measured particle, but delay the publication of the measured result, 
measured quantity (a x or a z ) until he receives instruction from Alice when she receives both particles of the same 
EPR pair. 

(3b) When they choose the coding mode, Bob or Charlie performs an coding operation. The coding operation is 
one of the four unitary operations given Eqs. Q . . . ijTUl) . These operations correspond to the bit values 00, 01, 
10 and 11, respectively. After the coding operations, they return the particles back to Alice. 

(4) After receiving the particles from Bob and Charlie, Alice does the following actions. For those particles that have 
not been chosen for eavesdropping check, Alice first undoes the previous order rearrangement operation to recover the 
correct EPR pair correspondence. Alice then makes a Bell-basis measurement for each pair, so that she knows the 
state after the combined operations of Bob and Charlie. This combined operation of Bob and Charlie are used as the 
shared secret key. When Bob and Charlie work together, they will know this shared key. The product of operations 
of the four coding operations is given in Table [I] The minus sign in this table does not have any physical effect and is 
neglected. From this table, we see that the product of the two coding operation has a very simple rule in the binary 
numbers they represent. The result is the bitwise modulo 2 sum of the binary numbers of Bob and Charlie, i.e., 
K a — Kb © K c where Ka, Kb and Kc are the binary keys of Alice, Bob and Charlie respectively. 

For those pairs whose partner particle have been chosen by Bob(Charlie) for eavesdropping check, Alice makes 
randomly the a z or a x measurement on the particle returned from Bob(Charlie), and using the same measuring- 
basis to measure the particles returned from Charlie(Bob). At this moment, Alice asks Bob(Charlie) to publish 
the measured quantity, and the measurement value of the particles, and asks Charlie(Bob)to publish the coding 
operations performed on the partner particles. In half of these instances, Alice chooses the same measuring-basis 
as Bob(Charlie). From the expressions for Bell-basis states, the results of measurement are correlated. With this 
knowledge, Alice checks the consistence of the results to find eavesdropping. There are also a small portion in which 
the same EPR pair are chosen simultaneously by Bob and Charlie for eavesdropping check. In half the case, Bob and 
Charlie choose the same measuring-basis, and these instances can also be used for eavesdropping check. If the error 
rate is high, they conclude the QSS process as insecure and abort the process. If there is no error in the eavesdropping 
check, they conclude the QSS as secure and continues to step 5). 

(5) Alice publishes the order rearrangement operation for each group, and those particles that have been chosen for 
eavesdropping check. With these information, Bob and Charlie get the correct correspondence of their particles. The 
production of their coding operation is the key Alice wants Bob and Charlie to share. 

For preventing a dishonest agent from eavesdropping with a fake signal, Alice inserts some decoy photons in some of 
the EPR groups. That is, Alice replaces some of the particles in EPR pairs with decoy photons which can be produced 
by means that she measures one particle in an EPR pair with choosing a z or a x randomly. If the dishonest agent 
intercepts these decoy photons in the EPR-pair groups and resends a fake signal, his action will introduce inevitably 
errors in the results of the decoy photons which is chosen by the other agent and measured with the two measuring 
bases, a z and a x , for eavesdropping check, same as BB84 QKD protocol [4|. 

In this scheme, almost all of the instances except those chosen for eavesdropping can be used for quantum secret 
sharing. This scheme is thus efficient. Furthermore, each successful EPR pair carries two qubits of information in this 
scheme. Moreover, the three parties in the communication use only a small amount of classical communication. Alice 
needs to publish only the order rearrangement operation for each group, and Bob and Charlie need only to publish 
the following information: positions, measuring-basis and measured results and the coding operations of the particles 
that have been chosen for eavesdropping checking analysis. 

First we explain the working mechanism of the checking mode. For instance, when Bob chooses the checking mode 
for a particle from an EPR pair in state — -±=(|0)_b|1)c — |l)s|0)c), and he makes a a z measurement to this 
particle and obtains \0}b, and as a result, the corresponding particle C that is in Charlie's site collapses into state |l)c- 
Charlie does not know Bob has chosen this pair for eavesdropping check, and he chooses for this particle to perform 
the a z measurement with a small probability, and obtains, say 1 1) c if no eavesdropping exists. Charlie publishes 
the position of the particle he measures, and delays the publication of the measuring-basis and the measured result 
until he receives instruction from Alice. With a large probability, Charlie will choose the coding mode and performs 
a coding operation on it, say U3. This changes the state of his particle from \l)c to |0)c, and returns the particle 
back to Alice. As Alice knows that this particle C is the partner particle of particle B which was measured by Bob, 
Alice measures a z for particle C. If no eavesdropping exists, she will obtain \0)c- At this point, Alice asks Bob to 
publish his measuring-basis and the measured result, and asks Charlie to publish his coding operation. With these 
knowledge, Alice can check the consistence of the measured results. 
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This eavesdropping check guard against the intercept-resend attack. For instance, suppose Eve can intercept all 
particles sent to Bob and Charlie, and stores them for a while. At the same time, he sends fake particles to Bob 
and Charlie respectively. Without knowing the particles are fake, Bob and Charlie encode the unitary operations 
respectively on their particles and return them back. Bob* intercepts them again and measures their states and steals 
the operations of Bob and Charlie. He then performs these operations on the genuine particles he stores previously 
and sends them back to Alice. A collapse measurement in the checking mode exposes Eve's interception. 

The QSS protocol is equivalent to a modified BBM92 QKD protocol for those chosen for the eavesdropping check. 
For these instances where Charlie(Bob) chooses randomly to measure in the a x or the <r z basis, Alice is in effect doing 
a BBM92 QKD process with Charlie(Bob) with an eavesdropper Eve present. If Bob performs honestly, then there is 
no error rate in these checking instances. If Bob is dishonest, the error rate will be as high as 25%, just like that in the 
BBM92 QKD protocol. The proof of security for BBM92 QKD in ideal condition is given in Ref.lU and that with 
practical conditions was given in detail in Ref.[U- Hence the present QSS protocol is secure. The first eavesdropping 
check thus ensures that the particles arrive Bob and Charlie's sites securely. 

When Bob* tries to steal the information by making Bell-basis measurement on pairs of particles returned by Bob 
and Charlie. Bob* has to make a guess of the correspondence of the particles. But he will cause a large error rate. 
Suppose that Alice uses only four permutations to reshuffle the order of particles in each group of four EPR pairs, 
Bob* has only 1/4 probability to make the right guess. For those wrongly chosen pairs, the two particles he measures 
is uncorrelated, say particle B from the first EPR pair and particle C from the second EPR pair is mistreated by 
Bob* as an EPR pair, then the density operator is 



Pb 1 c 2 = Pb 1 ® Pc 2 



/ 1/4 \ 

1/4 

1/4 

V 1/4/ 



(11) 
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where ~p B — TrctipB-iCi) and ~Pc 2 = Trs 2 (Pb 2 c 2 ) are the reduced density matrices of particle Bi and particle C2, 
respectively. When pb ± c 2 is measured in the Bell-basis, the result can be any of the 4 Bell-basis states with 25% 
probability each. Thus Bob* will introduce 3/4 x 3/4=56.25% error rate in the results. They can detect Bob* 
easily by checking a sufficiently large subset of results randomly chosen. If Alice allows more number of different 
permutations, the error rate Bob* introduces in this type of attack is even greater. 

In Refs. 32, 33L l34| . the optimal individual attack done by Bob* can be represented by an unitary operation on the 
travelling particle sent to, say to Charlie, and then back to Alice with an auxiliary system whose initial state is |0), 
i.e., 

Utb \0\0) =\0\0)_ (12) 
U TB \Z)\0) = cos^|£}|0)+ sin4>|£) 1 1) (13) 



where |£) and | Q are the two eigenvectors of a two-level operator 32, 33], and e [0, 7r/4] characterizes the strength of 
Bob*'s attackj^J]. This eavesdropping does not violate the non-cloning theorem[33 as Bob* just exchanges the state 
of the particle of Charlie with the auxiliary state conditionally. So the information (Ib) that Bob* can steal from the 
particle coded by Charlie is less than twice the information (Iq) carried by the particle sent from Alice to Charlie. 
Although the particle for Charlie carries 1 bit of quantum information and the four quantum operations can send 2 
bits of information, Bob* will at best get the two bits of information if he does the eavesdropping. Then Ig < 2Iq. 

We can calculate the relations between the information Bob* can obtain and the error rate introduced by her 
disturbance. For Alice and Charlie, the action of Bob*'s eavesdropping will introduce an error rate 

e = Pfsin 2 ^ (14) 

where Pj is the probability that the quantum signal is in state £)■ Let us suppose that the entangled state between 
Alice and Charlie is In this case, |£) = |0) and |0 = |1) are the eigenvectors of a z , Pj = h. The effect of Bob*'s 

eavesdropping is 

Utb |0) |0) = |0) |0) = |00) , (15) 
U TB \1)\0) = cos0|l) |0) +sin0|O> |1) = cos^|10> +sin0|Ol) , (16) 

e =isin 2 0. (17) 

After the eavesdropping, the state of the system composed of the particles belong to Alice and Charlie, and the 
auxiliary system is 



1 
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\S) = —(\0) a Utb\1) c \0) p -\1) a Utb\0) c \0) p ) (18) 
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= ^=[\0) A (oos0|l) o |0) P + sin0|O) c |1) P ) - |0) c |0> P ], 

where the subscript P represents the auxiliary system. 

For the sub-system that composed of Alice's particle and the auxiliary system, its density matrix p is obtained by 
tracing out the freedom of Charlie's particle, i.e., 



p = icos 2 0|O) A |O) PA (O| p 



1 



isin 2 0|O) A \l) PA (0\ P (1| + \ \\) A \Q) PA (1\ P ■ 
1 



.-. 2 sin^|l) A \0) PA (0\ P (1|, 

which can be rewritten in the basis {|00) , |11) , 1 01} , |10)} as 



/ | cos 2 <j) 


l 

2 



\ 





±sin 2 . 



\ -isil 



■ sm < 
l 

2 



(19) 
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The information I p that Bob* can extract from the sub-system is just equal to the Von Neumann entropy |29| . i.e., 



Ib =^-A 4 log 2 Xi, 



(20) 



where Xi (i=0, 1, 2, 3) are the eigenvalues of p, which are Ao,i = 0, A 2 = \ cos 2 <fr and A3 = | + | sin 2 <ft, respectively. 
Then 

I B = -icos 2 <?!)log 2 (icos 2 0) - (i + isin 2 0)log 2 (i + isin 2 0) 

= -(g - £ ) lo S2(2 3 — g2 — 2 — ' 

When e = 0.25, Is = 1 which is the maximal information that Bob* can obtain from his eavesdropping which is 
the one in the the intercept-resend eavesdropping strategy. In other cases, Iq < 1 = I A c, where I A c is the mutual 
information between Alice and Charlie. Then this QSS is secure. 

Under practical conditions, the detection efficiency is not equal to 1, and the quantum channel is noisy. Then error 
corrections and post-processing have to be used. Accordingly, the step 4) of this QSS should change to accommodate 
some errors in the process: if the error rate is below certain threshold e, the QSS process is then concluded as secure. 
If the error rate is higher than the threshold, the QSS process is concluded as insecure, and the process halts. The 
exact value of e depends on the way the quantum correction is done. For instance for BB84 QKD protocol, the e is 7% 
for the error-correcting and post-processing methods proposed in Refs.JSfiLISTjl. and 11% by the methods proposed in 
Refs. |38Ll39| |. and 19% by the Gotteman and Lo method [Icj. These details are important and merit detailed analysis, 
and will not be studied in this Letter. 

In summary, we introduce a QSS protocol using the ideas from dense coding[26j and order rearrangement of EPR 
pairs. In this QSS scheme, the amount of information carried by each EPR pair is two bits for each successful round 
of communication. The amount of classical communication exchanged in the process is also reduced. The scheme is 
efficient since all the EPR pairs can be used for quantum secret sharing except those that chosen for eavesdropping 
check. Like the KKI 8] QSS scheme, this scheme uses EPR pairs, which is easier to create rather than three-partitite 
entangled state. With these two techniques, not only QSS can be done securely with EPR pairs, but also the capacity 
is increased to 2 bits for each EPR pair and the classical information exchanged is reduced to | bit for each useful 
qubit on the average. 

This work was supported by the National Fundamental Research Program Grant No. 001CB309308, China National 
Natural Science Foundation Grant No. 60073009,10325521,10447106, the Hang-Tian Science Fund, and the SRFDP 
program of Education Ministry of China. 
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FIG. 1: Illustration of the QSS scheme with order rearrangement apparatus (REAR system). 
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FIG. 2: Four rearrangement operations for EPR pairs. 
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